AWS WAF traffic blocked by specific rule on multiple IPs

cloudtrail
This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a specific AWS Web Application Firewall (WAF) rule blocks traffic from multiple IPs.

Strategy

The rule monitors AWS WAF logs and detects when the @system.action has a value of BLOCK.

Triage and response

  1. Inspect the @http.request_id: {{@http.request_id}} to confirm if this request should have been blocked or not.
  2. If the request should have been blocked, then navigate to the IP Investigation dashboard. Inspect other requests from the IP address:{{@network.client.ip}} to find any other potentially malicious behaviors from the IP.